NationalSecurityAgency/ghidra · error · RuntimeError

Usage: ghidra trace install-hooks

Error message

Usage: ghidra trace install-hooks

What it means

Raised by ghidra_trace_install_hooks when any argument is given. install-hooks registers the LLDB event hooks that keep the Ghidra trace synchronized; it is parameterless (commands.py:1983). Typically you use sync-enable instead, which installs hooks automatically.

Source

Thrown at Ghidra/Debug/Debugger-agent-lldb/src/main/py/src/ghidralldb/commands.py:1983

        put_threads()
        put_frames()
        put_breakpoints()
        put_watchpoints()
        put_available()


@convert_errors
def ghidra_trace_install_hooks(debugger: lldb.SBDebugger, command: str,
                               result: lldb.SBCommandReturnObject,
                               internal_dict: Dict[str, Any]) -> None:
    """Install hooks to trace in Ghidra.

    Usage: ghidra trace install-hooks
    """

    args = shlex.split(command)
    if len(args) != 0:
        raise RuntimeError("Usage: ghidra trace install-hooks")

    hooks.install_hooks()


@convert_errors
def ghidra_trace_remove_hooks(debugger: lldb.SBDebugger, command: str,
                              result: lldb.SBCommandReturnObject,
                              internal_dict: Dict[str, Any]) -> None:
    """Remove hooks to trace in Ghidra.

    Usage: ghidra trace remove-hooks

    Using this directly is not recommended, unless it seems the hooks are
    preventing lldb or other extensions from operating. Removing hooks will break
    trace synchronization until they are replaced.
    """

    args = shlex.split(command)

View on GitHub (pinned to d5f144c24d)

Solutions

1. Run bare: `ghidra trace install-hooks`.
2. Prefer `ghidra trace sync-enable` for normal workflows — it installs hooks and enables the current process in one step.

Example fix

// before
ghidra trace install-hooks force
// after
ghidra trace install-hooks

assert len(command.split()) == 0, "install-hooks takes no arguments"

When it happens

Trigger: Appending flags like `ghidra trace install-hooks force` or a process specifier, or stray text.

Common situations: Users try to scope hooks to a process or pass options; hooks are global. Re-installing over existing hooks is generally harmless.

Related errors

• Usage: ghidra trace remove-hooks
• Usage: ghidra trace disassemble ADDRESS
• Usage: ghidra trace put-processes
• Usage: ghidra trace put-available
• Usage: ghidra trace put-breakpoints

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/7199fb03a50e978a. Report an issue: GitHub.